Google Sued for Allegedly Tracking App Users After They Opt Out
Consumer Reports has no financial relationship with advertisers on this site.
Is Google tracking you as you move around the internet, even if you've opted out of data collection?
A lawsuit filed in California is making that claim. The issues are complicated, but one thing seems clear: The suit highlights the sprawling nature of Google's business, and how hard it is for consumers to understand all the ways the company can collect and use their personal data.
The lawsuit was filed in federal court in San Jose, Calif., on behalf of two consumers, but it asks for class action status that could allow many more plaintiffs to join the suit.
If you've got a Google account, you can use a privacy setting called Web & App Activity to tell the company not to collect and use information it gathers from your searches, web browsing, and other sources. The setting was added in 2019.
What the lawsuit alleges is that the setting doesn't stop all data collection, in particular when data is collected from mobile apps.
It reads, in part, "Google...intercepts, tracks, collects and sells consumer mobile app browsing history and activity data regardless of what safeguards or 'privacy settings' consumers undertake to protect their privacy."
"Google promises privacy, but values voyeurism," says Jesse Panuccio, a partner at Boies Schiller Flexner, the law firm that filed the suit. "These consumers are suing to hold Google to their promise.” (The same firm filed another lawsuit last month claiming that Google violated federal wiretapping and privacy laws by collecting consumer data when people were using Incognito mode in Google's Chrome browser.)
Experts have documented that certain information does go to Google when you use any of hundreds of thousands of mobile apps, even if you opt out of data collection through your Google account. What's not so clear, privacy and technology experts say, is whether this particular form of data collection violates the company's promises to its users.
Google didn't respond to requests for an interview by the time of publication.
There's No Avoiding Google
"At its heart, Google is a marketing platform," says Serge Egelman, chief technical officer for AppCensus, a firm that analyzes technology for privacy and security, and a researcher at the University of California, Berkeley.
Besides being the world's biggest search engine, Google is central to the online economy. It collects data on users that's used for targeted advertising. It also takes orders for ads, decides where to place them on webpages and apps, and helps companies determine how people use their websites and apps.
One of the tools Google provides to more than a million apps is called Firebase. It can help developers perform tasks such as counting how many people use an app and monitoring what they do with it, along with some other functions. (Consumer Reports uses Firebase in its own mobile apps.)
That's the data that the lawsuit alleges flows to Google, in conflict with the company's statements to consumers that they can stop Google's data collection.
"Google collects data about you in a ton of different ways, often for its own direct benefit, but sometimes on behalf of others," says Justin Brookman, director of privacy and technology policy at Consumer Reports.
According to Brookman, if the data is only being used to help developers monitor their own apps, it's probably "a stretch" to say that Google is violating its obligations to consumers. "Google crunching data for someone else isn't the same thing as Google using that data to target ads," he says.
However, Brookman adds, "It is pretty confusing for an ordinary person to understand who has their data."
Everyone who goes online shouldn't be expected to understand and control all the ways their information might be used, he says. Instead, "the law should put substantive limitations on how companies can process and share consumer data."
Egelman of AppCensus is more skeptical about how Google might use the data collected through Firebase. He says some of the information could be employed for marketing. Developers can change software settings to instruct Google not to use the data generated by their apps. However, according to Egelman the settings are rarely changed. "Far less than 10 percent of the time," he says.
"From a consumer's standpoint, it's nearly impossible to figure what the data is going to eventually be used for," Egelman says. "But the default assumption should be that it's being collected for marketing purposes unless there's clear and conspicuous evidence to the contrary."
How to Change Your Google Settings
The lawsuit doesn't allege that Google continues to collect your search history and other consumer data if you use the company's Web & App Activity settings.
Among other data, Google says the setting controls whether the company can record "Searches and other things you do on Google products and services, like Maps and Play," "Sites and apps that partner with Google to show ads," and "Sites and apps that use Google services, including data that apps share with Google."
To use it, sign in on any Google website (such as Gmail), and then click the icon in the top right > Manage your Google Account > Manage your data & personalization.
If Web & App Activity is on, click on it. Then, on the next screen, click the toggle, and hit Pause to opt out of data collection.
According to the company, this could make Google services "less personalized," and it will disable certain useful features within products, including Maps and Google Assistant.
Consumer Reports also has instructions on how to use other Google privacy settings, from an auto-delete feature to location history.
More from Consumer Reports:
Top pick tires for 2016
Best used cars for $25,000 and less
7 best mattresses for couples
Consumer Reports is an independent, nonprofit organization that works side by side with consumers to create a fairer, safer, and healthier world. CR does not endorse products or services, and does not accept advertising. Copyright © 2020, Consumer Reports, Inc.
